| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-08-26 | |||
| 14:51:32 | sean-k-mooney | gmann: can we make default dynamic | |
| 14:51:37 | gmann | sean-k-mooney: but i was reading chat, is noonedeadpunk use case for specific host to control such VM creation? | |
| 14:51:45 | sean-k-mooney | gmann: e.g. default it to whatever teh current flavor create policy is | |
| 14:51:47 | gmann | sean-k-mooney: dynamic? | |
| 14:51:57 | gmann | sean-k-mooney: yeah, we can do that | |
| 14:52:04 | sean-k-mooney | gmann: no i dont think so | |
| 14:52:26 | sean-k-mooney | gmann: i think noonedeadpunk wanted to restrct who could create flavors with local storage | |
| 14:52:46 | sean-k-mooney | there are ways to prevent host from booting gues with local sotrage alredy | |
| 14:52:48 | lpetrut | hi, looks like we have an unusual issue on Windows: https://review.opendev.org/#/c/748250/ a release note filename containing pipes prevents Nova from being cloned on Windows :) | |
| 14:52:59 | gmann | sean-k-mooney: i see | |
| 14:53:11 | sean-k-mooney | gmann: either via config or using a trait and isolated aggreates feature | |
| 14:53:21 | noonedeadpunk | to be exact, I wanted to restrict users who can create VMs with ephemeral storages | |
| 14:53:26 | gmann | ok | |
| 14:53:37 | sean-k-mooney | noonedeadpunk: that is slightly different then | |
| 14:53:52 | noonedeadpunk | For example I generally want to prohibit usage of ephemeral/local storages,m but what 1 groups of users to be still able to do that | |
| 14:53:55 | sean-k-mooney | one way to do that is to make the ephemeral flavors private | |
| 14:54:08 | openstackgerrit | Alex Xu proposed openstack/nova master: Provider Config File: Enable loading and merging of provider configs https://review.opendev.org/693460 | |
| 14:54:17 | sean-k-mooney | so make all you public flaovr bfv only | |
| 14:54:22 | stephenfin | bauzas: They are identical, but I didn't want to make the two series depend on each other | |
| 14:54:29 | noonedeadpunk | but even with lavor with 0 disk it's possible to create server without cinder volume | |
| 14:54:32 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/ussuri: tests: Add reproducer for bug #1889633 https://review.opendev.org/748251 | |
| 14:54:32 | openstack | bug 1889633 in OpenStack Compute (nova) ussuri "Pinned instance with thread policy can consume VCPU" [High,Triaged] https://launchpad.net/bugs/1889633 | |
| 14:54:32 | stephenfin | bauzas: I'll rebase once one of them lands | |
| 14:54:32 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/ussuri: hardware: Reject requests for no hyperthreads on hosts with HT https://review.opendev.org/748252 | |
| 14:54:36 | noonedeadpunk | s/lavor/flavor/ | |
| 14:54:42 | sean-k-mooney | then use flavor access to allow access to the other falvors to a specific tenant or set of tenants | |
| 14:54:44 | gmann | sean-k-mooney: noonedeadpunk we can default it to 'os_compute_api:os-flavor-manage:create' rule itself so whatever create policy has in any deployment (default or overridden ) stays the same with new policy check. | |
| 14:54:53 | alex_xu | stephenfin: gibi ^ rebased 693460, the conflict at admin doc | |
| 14:54:55 | bauzas | stephenfin: I'd have appreciated a -2 somewhere :) | |
| 14:55:01 | bauzas | or a DNM | |
| 14:55:06 | sean-k-mooney | gmann: that would not actully address noonedeadpunk usecase | |
| 14:55:12 | sean-k-mooney | it would do what i asked you | |
| 14:55:22 | stephenfin | bauzas: well that would have defeated the purpose, wouldn't it? :P | |
| 14:55:42 | sean-k-mooney | we would need a policy on spwan that blocked ephemeral flavors | |
| 14:55:47 | lyarwood | elod: https://review.opendev.org/#/c/747358/ should also be ready now btw | |
| 14:55:52 | bauzas | stephenfin: one is a bugfix, the other one is a feature that is proritized in a runwayu | |
| 14:55:55 | lyarwood | elod: unless you want me to squash | |
| 14:55:57 | sean-k-mooney | unless you were in a specific group | |
| 14:56:05 | bauzas | stephenfin: so, honestly... :D | |
| 14:56:10 | sean-k-mooney | but i think falvor access and tenants achive a similar result | |
| 14:56:23 | noonedeadpunk | sean-k-mooney: I mean there's no way to create a flavor that prohibit usage of ephemeral/local volumes | |
| 14:56:27 | gmann | sean-k-mooney: yeah | |
| 14:56:45 | sean-k-mooney | noonedeadpunk: well the flavor specifcy the disk usage | |
| 14:57:00 | sean-k-mooney | you cant consme disk based on image metadata | |
| 14:57:04 | stephenfin | Yeah, I wasn't sure how else to do it without ending up with a 15+ patch series :-\ | |
| 14:57:10 | sean-k-mooney | but you can restict who can use that flavor | |
| 14:57:11 | noonedeadpunk | yes, but even with 0 disk and 0 swap - ephemeral will still be created if volume is not provided? | |
| 14:57:27 | stephenfin | especially given I couldn't place it at the bottom of either series | |
| 14:57:31 | sean-k-mooney | noonedeadpunk: if you dont use boot form volume | |
| 14:57:49 | sean-k-mooney | although i argued that its a bug that that is allows | |
| 14:58:12 | noonedeadpunk | Yeah, so what I would be expecting is that nave printed that it's not allowed for instance | |
| 14:58:21 | sean-k-mooney | i wanted 0 disk to mean bfv only | |
| 14:58:30 | sean-k-mooney | other felt that would break some pepole | |
| 14:59:19 | sean-k-mooney | noonedeadpunk: we may or may not beable to contole that by policy dependingo n what info is currenlty passed to server create | |
| 14:59:21 | noonedeadpunk | That why I was talking about policy, which can be configured if just reject users request when he tries to boot server without volume with 0 disk in flavor | |
| 14:59:22 | gmann | flavor creation control is not needed really but booting VM control with new policy | |
| 14:59:43 | sean-k-mooney | gmann: yes it would have to be a check on server create | |
| 14:59:52 | sean-k-mooney | either an api check or policy | |
| 15:00:08 | stephenfin | bauzas: if you can hit https://review.opendev.org/#/c/747744/ then I can drop one of those patches and rebase both series onto one | |
| 15:00:10 | sean-k-mooney | oh donwstream call got to go | |
| 15:00:37 | noonedeadpunk | like the point here is that ppl on public clouds usually not sure what they want, and just go the easiest path, which results in lost data for them... | |
| 15:00:47 | bauzas | stephenfin: yeah, that's possible | |
| 15:01:50 | gmann | sean-k-mooney: noonedeadpunk: in that case we can default the new policy with this https://github.com/openstack/nova/blob/a7735d5e379c20c59cfb639f9f4d339bcffca2f9/nova/policies/servers.py#L167 | |
| 15:04:48 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/train: tests: Add reproducer for bug #1889633 https://review.opendev.org/748254 | |
| 15:04:48 | openstack | bug 1889633 in OpenStack Compute (nova) ussuri "Pinned instance with thread policy can consume VCPU" [High,In progress] https://launchpad.net/bugs/1889633 - Assigned to Stephen Finucane (stephenfinucane) | |
| 15:04:48 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/train: hardware: Reject requests for no hyperthreads on hosts with HT https://review.opendev.org/748255 | |
| 15:05:20 | noonedeadpunk | I mean like `os_compute_api:servers:create:zero_disk_flavor` is already checking the flavor. Maybe somewhere near it's possible to check if flavor has zero size disk, but has no volume attached? | |
| 15:05:42 | noonedeadpunk | I'm not really familiar with nova codebase as it's so huge... | |
| 15:06:32 | sean-k-mooney | you proably need the block device mappings | |
| 15:07:17 | sean-k-mooney | that said i think we have a bfv flag somewhere | |
| 15:08:18 | noonedeadpunk | At least I hope I told userstory I'm trying to implement in an understandable way.... | |
| 15:08:44 | sean-k-mooney | you did | |
| 15:08:57 | sean-k-mooney | you want to restict who can boot a vm without bfv | |
| 15:09:04 | sean-k-mooney | using policy and roles | |
| 15:09:08 | sean-k-mooney | right | |
| 15:10:14 | noonedeadpunk | ideally yes. How to restrict it on whole cloud I guess you've already answered and it's with max_local_block_devices | |
| 15:10:26 | noonedeadpunk | eventually that will probably work for me as well | |
| 15:11:14 | sean-k-mooney | yes the config option will also block it much latere on the compute host rather then api | |
| 15:12:20 | noonedeadpunk | (in the worst case scenario would use isolate aggregates which will be also tricky because of the need to separate resources) | |
| 15:12:44 | noonedeadpunk | but yeah, checking that on api level might be more efficient | |
| 15:12:55 | noonedeadpunk | and produce more understandable output | |
| 15:14:04 | sean-k-mooney | an api check woudl allow us to retrun a specific api respoce saying why | |
| 15:14:11 | sean-k-mooney | currently it would jsut get a no valid host | |
| 15:14:19 | noonedeadpunk | yeah | |
| 15:14:24 | sean-k-mooney | which is not a great user experice | |
| 15:14:48 | gmann | zero_disk_flavor policy already control the zero disk boot if it is not bfv | |
| 15:15:28 | noonedeadpunk | zero_disk_flavor eventually can only prohibit spawning a VM when it's created with flavor with 0 disk | |
| 15:15:29 | sean-k-mooney | oh so the edgecase it did not fix was allowing bfz when disk >0 | |
| 15:15:46 | sean-k-mooney | there is an edgecase that it breaks | |
| 15:15:47 | noonedeadpunk | even if its bfv | |
| 15:17:12 | gmann | https://github.com/openstack/nova/blob/eef4b5435e7cdfe53ee9d9265d96c7dd278d9e93/nova/compute/api.py#L730 | |
| 15:17:51 | sean-k-mooney | ya htat is blocking using 0 disk flavor without bfv | |
| 15:17:58 | noonedeadpunk | I think it's pretty different | |
| 15:18:00 | noonedeadpunk | yeah | |
| 15:18:09 | sean-k-mooney | it does not prevent createing vms with non 0 disk flavors | |
| 15:18:25 | noonedeadpunk | eventually... it blocks 0 disk flavor with bfv as well. At least blocked on train for me... | |
| 15:18:44 | sean-k-mooney | it should not | |
| 15:19:03 | gmann | yeah, it should not block that | |
| 15:19:04 | sean-k-mooney | that check should only block non bfv vms with 0 disk flavors | |
| 15:19:24 | noonedeadpunk | oh, yeah, maybe you're right | |